Every route here uses tenant credentials, never a workspace token.
GET /v1/workspaces
List the tenant’s workspaces. Returns 200.
{
"workspaces": [
{ "slug": "demo", "createdAt": "2025-06-01T09:15:00.000Z", "walletCount": 12 }
]
}GET /v1/quota
Report the tenant’s configured limits and current usage. Returns 200.
curl "$API_URL/quota" -H "X-Api-Key: $API_KEY" -H "X-Api-Secret: $API_SECRET"{
"workspaces": { "used": 3, "limit": 10 },
"wallets": { "used": 128, "limit": 500 }
}Two counters, both tenant-wide: workspaces you have created, and wallets across
all of them. walletCount on each workspace record breaks the second one down.
This route does not report how many workspaces may be open at once. That
ceiling exists — it is what session_capacity_exceeded enforces — but it is
not exposed by any route.
POST /v1/workspaces
Create a workspace. Returns 201.
Request
{ "slug": "demo", "password": "a-strong-workspace-password" }| Field | Type | Required | Notes |
|---|---|---|---|
slug |
string | yes | Lowercase letters, digits, hyphens; starts alphanumeric; ≤63 chars |
password |
string | yes | At least 12 characters. Shorter is rejected with 422 and weak_password |
Response
{
"workspace": {
"slug": "demo",
"createdAt": "2025-06-01T09:15:00.000Z",
"walletCount": 0
}
}Errors
| Status | Code |
|---|---|
| 400 | invalid_body, invalid_slug |
| 401 | bad_api_key |
| 409 | workspace_exists, quota_workspaces_exceeded |
| 422 | weak_password |
| 429 | workspace_creation_rate_limited, workspace_recreation_cooldown |
DELETE /v1/workspaces/{slug}
Delete a workspace and everything in it. Returns 204.
Query parameters
| Parameter | Values | Default | Meaning |
|---|---|---|---|
force |
true or false |
false |
Delete even while a session is open |
force accepts exactly those two strings. Anything else returns 400 with
invalid_parameter — there is no truthy-string coercion.
Without force, deleting a workspace with an open session returns 409 with
workspace_in_use.
Errors
| Status | Code |
|---|---|
| 400 | invalid_slug, invalid_parameter |
| 401 | bad_api_key |
| 404 | workspace_not_found |
| 409 | workspace_in_use |
Related
- Manage workspaces — the task walkthrough